Add green-bean inventory and cupping features

Ports inventory management and SCA-style cupping scoring from
hope_roaster: lot tracking with audit-logged consumption, cupping
sessions with server-authoritative scoring and a live radar chart,
and links from the planner (draw-from-lot, open-cupping-session).

Also fixes the Blend/Single-origin toggle layout, replaces tooltips
with an in-context "why" teaching layer, and stages the planner UI
into pre-roast vs. post-roast phases.

public/sw.js

@@ -1,15 +1,22 @@
-const CACHE_NAME = "roast-planner-static-v4";
+const CACHE_NAME = "roast-planner-static-v6";
+// Only /app is precached as a navigable page: it is a data-free authenticated shell (draft
+// data lives only in account-scoped local storage, and logout clears that namespace), so it is
+// the one page that is both safe and useful to relaunch offline. The marketing page, auth
+// pages, account, admin, inventory, and cupping all depend on the network (auth checks, live
+// data) and are deliberately left off this list rather than cached in a way that could show
+// stale content.
 const APP_SHELL = [
-	"/",
-	"/landing.html",
 	"/app",
 	"/app.css",
 	"/worksheet.css",
 	"/manifest.webmanifest",
 	"/icon.svg",
 	"/js/main.js",
-	"/js/landing.js",
-	"/js/admin.js",
+	"/js/api.js",
+	"/js/nav.js",
+	"/js/toast.js",
+	"/js/why-panels.js",
+	"/js/lot-picker.js",
 	"/js/prefill-ui.js",
 	"/js/alog-ui.js",
 	"/js/print.js",
@@ -18,6 +25,7 @@ const APP_SHELL = [
 	"/shared/time.js",
 	"/shared/reference-data.js",
 	"/shared/curve.js",
+	"/shared/cupping.js",
 ];
 
 self.addEventListener("install", (event) => {
@@ -57,14 +65,13 @@ self.addEventListener("fetch", (event) => {
 		return;
 
 	if (request.mode === "navigate") {
-		// /app is a data-free authenticated shell: draft data lives only in account-scoped
-		// local storage and logout clears that namespace. This makes offline relaunch useful
-		// without ever caching account data or API responses.
+		// Only /app has a meaningful offline shell (see APP_SHELL comment above); every other
+		// page requires the network anyway, so let those navigations fail normally when offline
+		// rather than risk serving stale auth/account/admin content.
+		if (url.pathname !== "/app") return;
 		event.respondWith(
-			fetch(request).catch(() =>
-				url.pathname === "/app"
-					? caches.match("/app")
-					: caches.match("/landing.html"),
+			fetch(request).catch(
+				async () => (await caches.match("/app")) || Response.error(),
 			),
 		);
 		return;